We do not provide built-in DDoS protection. Mitigating an attack on your own services is your responsibility, and the practical answer is to put a protection or CDN service in front of the server.
What to use
Services such as Cloudflare filter traffic before it reaches your server. The principle is the same for all of them: your domain points at the protection service, and the service forwards legitimate traffic to your server.
Two things to get right when setting this up:
- Hide the server's real address. If the original IP address is still discoverable — in DNS records left behind, in mail headers sent directly from the server, or in an old A record for a subdomain — an attacker can bypass the protection entirely and hit the server directly.
- Restrict access to the server itself. Once traffic arrives through the protection service, allow HTTP and HTTPS only from that service's addresses. Otherwise the protection is optional from an attacker's point of view.
What you can do on the server
Request rate limits at web server level help against crude flooding and aggressive crawlers, though not against a genuinely distributed attack — see Setting up DDoS protection in ISPmanager for the mechanism and its limits. Caching also helps: a page served from cache costs a fraction of one generated afresh for every request.
If an attack is under way
Open a ticket with our Technical Support department. We can see what is arriving at the server and tell you the nature of the traffic, which determines what will actually help.
Note that where an attack threatens the operation of other systems, we may have to filter the traffic or temporarily block the address concerned, with or without prior notice depending on the severity — see What happens if a complaint is made about my server? Such measures are protective, not punitive, and are applied only to the extent needed.
Worth thinking about in advance
Attacks tend to arrive at the least convenient moment, and setting up protection under attack is considerably harder than setting it up beforehand. If your project is a likely target — a game server, a popular forum, anything competitive — arrange protection before you need it. See also Can I install a game server (Counter-Strike, Minecraft and similar)?
